From 04dfaf1fd3477b276385cf341f3ffbebe16a3779 Mon Sep 17 00:00:00 2001
From: Nathan Williams <nathan@traverse.com.au>
Date: Wed, 25 Mar 2009 20:33:42 +1100
Subject: [PATCH] --- yaml --- r: 166248 b: refs/heads/master c:
 78f857f265241dfa6f343d75b45e8b30935f71df h: refs/heads/master v: v3

---
 [refs]                        | 2 +-
 trunk/drivers/atm/solos-pci.c | 4 ++++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/[refs] b/[refs]
index 3cce21afdf3f..1af10b1c19bf 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 4dbedf43d26276f6d7c8c3146d0a5b2f0309d968
+refs/heads/master: 78f857f265241dfa6f343d75b45e8b30935f71df
diff --git a/trunk/drivers/atm/solos-pci.c b/trunk/drivers/atm/solos-pci.c
index bfef8d255811..6c828347c9cc 100644
--- a/trunk/drivers/atm/solos-pci.c
+++ b/trunk/drivers/atm/solos-pci.c
@@ -671,6 +671,10 @@ void solos_bh(unsigned long card_arg)
 				memcpy_fromio(header, RX_BUF(card, port), sizeof(*header));
 
 				size = le16_to_cpu(header->size);
+				if (size > (card->buffer_size - sizeof(*header))){
+					dev_warn(&card->dev->dev, "Invalid buffer size\n");
+					continue;
+				}
 
 				skb = alloc_skb(size + 1, GFP_ATOMIC);
 				if (!skb) {